Ubuntu Security Notice 3387-1 - Brian Neel, Joern Schneeweisz, and Jeff King discovered that Git did not properly handle host names in 'ssh://' URLs. A remote attacker could use this to construct a git repository that when accessed could run arbitrary code with the privileges of the user.
2454d1074bcfce4098620dc87e4f3cdd0b6f626dc388f4864442e2b508277d87